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AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the application: 

Listing of Claims: 

1. (Currently Amended) A method for monitoring a process, the method 

comprising: 

creating a signature representative of the process; 

continuously updating the created signature with a weighting scheme; and 
detecting abnormalities based upon the continuously-updated signature, 
wherein the process is related to usage of networked computing devices in 
a datacenter,-and 

wherein the signature includes information related to time— sensitive 
averaging that accounts for variation in a business cycleir.ll , and 

wherein the weighting scheme consists of a first weighting factor that 
represents a continuously-updated signature weight and a second weighting factor 
that represents a current data weight. 

2. (Original) The method of claim 1, wherein creating a signature comprises 
calculating an average and a standard deviation. 

3. (Currently Amended) The method of claim 2, wherein creating a signature 
comprises accelerated learning through setting a learning responsiveness ratio and incrementally 
increasing athe learning responsiveness ratio until the learning responsiveness ratio reaches a 
desired value, 
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wherein the learning responsiveness ratio is equated to the second weighting 
factor divided by the first weighting factor . 

4. (Original) The method of claim 2, wherein creating a signature comprises 
initially repeating a running average and standard deviation through a plurality of intervals. 

5. (Currently Amended) The method of claim 1, wherein updating the 
created signature comprises ensuring that recently-recorded data has a greater impact than older 
data by setting the secon d using a weighting factor to a value greater than the first weighting 
facto r ensure that recently recorded data has a greater impact than older data . 

6. (Original) The method of claim 1 , wherein updating the created signature 
comprises utilizing a moving average over a time to account for events occurring at unexpected 
times. 

7. (Original) The method of claim 1, wherein detecting abnormalities 
comprises determining if measured values are above an upper threshold or below a lower 
threshold. 

8. (Original) The method of claim 1, further comprising calculating upper 
and lower threshold limits based on jitter offset. 

9. (Previously Presented) A computer storage medium having computer 
executable instructions for performing the method of claim 1 . 

10. (Currently Amended) A method for detecting abnormalities occurring 
during a process based upon a continuously updated signature representative of the process, the 
method comprising: 
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creating a signature representative of the process; 

continuously updating the created signature with a weighting scheme; 

continuously monitoring a system parameter; 

computing a normal range of values for the system parameter based on the 
continuously-updated s ignature ; 

determining if the monitored system parameter is within the normal range; 

and 

indicating existence of an abnormality if the monitored system parameter 
is outside of the normal range, 

wherein the process is related to usage of networked computing devices in 
a datacenterrr.il , and 

wherein the weighting scheme consists of a first weighting factor that 
represents a continuously-updated signature weight and a second weighting factor 
that represents a current data weight. 

11. (Original) The method of claim 10, further comprising creating a signature 
by calculating an average and a standard deviation. 

12. (Currently Amended) The method of claim 11, wherein creating a 
signature comprises accelerated learning through setting a learning responsiveness ratio and 
incrementally increasing a the learning responsiveness ratio until the learning responsiveness 
ratio reaches a desired value, 

wherein the learning responsiveness ratio is equated to the second weighting 
factor divided by the first weighting factor . 
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13. (Original) The method of claim 11, wherein creating a signature comprises 
initially repeating the running average and standard deviation through a plurality of intervals. 

14. (Currently Amended) The method of claim 10, wherein computing a 
normal range of values comprises using a ensuring that recently-recorded data has a greater 
impact than older data by setting the second weighting factor to a value greater than the first 
weighting factor ensure that recently recorded data has a greater impact than older data . 

15. (Original) The method of claim 10, wherein computing a normal range of 
values comprises utilizing a moving average over a time to account for events occurring at 
unexpected times. 

16. (Original) The method of claim 10, wherein determining whether a 
monitored system parameter is within a normal range of values comprises determining if 
monitored system parameters are above an upper threshold or below a lower threshold. 

17. (Original) The method of claim 16, further comprising calculating upper 
and lower threshold limits based on jitter offset. 

18. (Previously Presented) A computer storage medium having computer 
executable instructions for performing the method of claim 10. 

19. (Currently Amended) A method for creating a signature useful for 
detecting abnormalities in a computing system environment, the method comprising: 

setting a learning responsiveness ratio; 
monitoring a system parameter; 
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adjusting the learning responsiveness ratio at fixed intervals until a desired 
value is reached; 

calculating an average and standard deviation for each interval; and 
using the average, standard deviation and learning responsiveness ratio to 

create the signature, 

wherein the learning responsiveness ratio is equated to a weighting factor 

that represents current data divided by a weighting factor that represents the 

signature, 

wherein the abnormalities in the computing system environment relate to 
usage of networked computing devices in a datacenter, and 

wherein the signature includes information related to time— sensitive 
averaging that accounts for variation in a business cycle. 

20. (Currently Amended) The method of claim 19, further comprising 
continuously updating the created signature through a weighting scheme, 

wherein the weighting scheme consists of a first weighting factor that represents a 
continuously-updated signature weight and a second weighting factor that represents a current 
data weight . 

21. (Original) The method of claim 20, further comprising detecting 
abnormalities based on the updated signature. 

22. (Original) The method of claim 19, wherein creating a signature comprises 
initially repeating the running average and standard deviation through a plurality of intervals. 
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23. (Currently Amended) The method of claim 20, wherein updating the 
created signature comprises using a ensuring that recently-recorded data has a greater impact 
than older data by setting the second weighting factor to a value greater than the first weighting 
facto r ensure that recently recorded data has a greater impact than older data . 

24. (Original) The method of claim 20, wherein updating the created signature 
comprises utilizing a moving average over a time to account for events occurring at unexpected 
times. 

25. (Original) The method of claim 21, wherein detecting abnormalities 
comprises determining if measured values are above an upper threshold or below a lower 
threshold. 

26. (Original) The method of claim 21, further comprising calculating upper 
and lower threshold limits based on jitter offset. 

27. (Previously Presented) A computer storage medium having computer 
executable instructions for performing the method of claim 19. 

28. (Currently Amended) A computerized system including computer storage 
medium for detecting abnormal activity in a computerized environment, the system comprising: 

monitoring tools for continuously monitoring a system parameter; 

a continuously—updated signature representative of normal typical values 
of the system parameter; and 

an abnormality indicator calculated based on the continuously updated 
signature, the abnormality indicator including a range of normal typical values for 
the system parameter, 
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wherein the signature is continuously updated with a weighting scheme, 

wherein the weighting scheme consists of a first weighting factor 
representing the weight of the continuously-updated signature and a second 
weighting factor representing the weight of current data, 

wherein the abnormal activity is related to abnormal usage of networked 
computing devices in a datacenter, and 

wherein the signature includes information related to time — sensitive 
averaging that accounts for variation in a business cycle. 

29. (Currently Amended) The system of claim 28, wherein the continuously- 
updated signature comprises an average and a standard deviation. 

30. (Currently Amended) The system of claim 28, wherein the continuously- 
updated signature comprises athe second weighting factor having a greater value than the first 
weighting factor to ensure that recently recorded data has a greater impact than older data. 

31. (Currently Amended) The system of claim 28, wherein the continuously- 
updated signature comprises a moving average over time to account for events occurring at 
unexpected times. 

32. (Original) The system of claim 28, wherein the abnormality indicator 
determines whether a monitored system parameter is within a normal range of values and 
whether monitored system parameters are above an upper threshold or below a lower threshold. 

33. (Original) The method of claim 28, wherein the abnormality indicator 
calculates upper and lower threshold limits based on jitter offset. 
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34. (Currently Amended) A computerized monitoring system including 
computer storage medium for monitoring a process, the monitoring system comprising: 

a signature creation module for creating a signature representative of the 
process; 

a signature updating module for continuously updating the created 
signature; and 

an abnormality detection module for detecting abnormalities based upon 
deviations from the updated signature, 

wherein the signature is continuously updated with a weighting scheme, 

wherein the weighting scheme consists of a first weighting factor that 
represents a continuously-updated signature weight and a second weighting factor 
that represents a current data weight, 

wherein the process is related to usage of networked computing devices in 
a datacenter, and 

wherein the signature includes information related to time sensitive 
averaging that accounts for variation in a business cycle. 

35. (Original) The system of claim 34, wherein the signature creation module 
includes tools for calculating an average and a standard deviation. 

36. (Currently Amended) The system of claim 35, wherein the signature 
creation module comprises tools for performing accelerated learning through incrementally 
increasing a learning responsiveness ratio until the learning responsiveness ratio reaches a 
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wherein the learning responsiveness ratio is equated to the second weighting 
factor divided by the first weighting factor . 

37. (Original) The system of claim 35, wherein creating a signature comprises 
initially repeating the running average and standard deviation through a plurality of intervals. 

38. (Currently Amended) The system of claim 34, wherein the signature 
updating module comprises tools for ensuring that recently-recorded data has a greater impact 
than older data by setting the second a weighting factor to a value greater than the first weighting 
facto r ensure that recently recorded data has a greater impact than older data . 

39. (Original) The system of claim 34, wherein the signature updating module 
comprises tools for calculating a moving average over a time to account for events occurring at 
unexpected times. 

40. (Original) The system of claim 34, wherein the abnormality detection 
module determines if monitored system parameters are above an upper threshold or below a 
lower threshold. 

41. (Original) The method of claim 34, wherein the abnormality detection 
module includes a mechanism for calculating upper and lower threshold limits based on jitter 
offset. 

42. (Currently Amended) A method for distinguishing between normal and 
abnormal behavior during a process, the method comprising: 

creating a signature representative of the process; 
continuously updating the created signature with a weighting scheme; 
monitoring a system parameter; 
31 36405 v4 Page 10 of 19 



Application No. 10/685,472 304947.02/MFCP.107184 

Response Filed 12/08/2008 

Reply to Office Action of 09/08/2008 

converting a numeric data stream representative of the monitored system 

parameter to a state for the process; and 

distinguishing between normal and abnormal behavior based on the state, 
wherein the process is related to usage of networked computing devices in 

a datacenter, 

wherein the weighting scheme consists of a first weighting factor that 
represents a continuously-updated signature weight and a second weighting factor 
that represents a current data weight, 

wherein the system parameter includes at least one of a usage variable, 
utilization, an error, and turn around time, and 

wherein distinguishing between normal and abnormal behavior includes 
utilizing time sensitive averaging to account for variation in a business cycle. 

43. (Original) The method of claim 42, further comprising converting the 
numeric data streams to multiple sub-states. 

44. (Original) The method of claim 42, further comprising determining a root 
cause of an abnormality based on the state. 
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